IAPP Certified Information Privacy Professional/United States (CIPP/US) CIPP-US Exam Questions

The FTC’s privacy report, titled “Protecting Consumer Privacy in an Era of Rapid Change”, proposed a framework for companies that collect and use consumer data. The framework consisted of three core principles: privacy by design, simplified consumer choice, and greater transparency. Privacy by design means that companies should incorporate privacy protections into their everyday business practices, such as data security, reasonable collection limits, sound retention practices, and data accuracy. Simplified consumer choice means that companies should provide consumers with clear and easy-to-understand choices about the collection and use of their data, and respect their preferences. Greater transparency means that companies should increase the visibility and accessibility of their data practices, such as providing clear and concise privacy notices, educating consumers about the commercial data practices, and providing consumers with access to their data. Enhancing security measures is not one of the core principles of the FTC’s privacy framework, although it is a component of the privacy by design principle.  References:

IAPP CIPP/US Body of Knowledge , Section I.A.1.a

IAPP CIPP/US Textbook , Chapter 1, pp. 13-15

FTC Privacy Report , Executive Summary, pp. i-vii

According to the web search results from my predefined tool, Florida is the only state among the four options that currently imposes a definite limit for notification to affected individuals in case of a data breach.  Florida’s law requires that notice be provided within 30 days after determination of the breach or reason to believe a breach occurred, unless delayed by law enforcement or measures to determine the scope of the breach and restore the integrity of the system 1 .  The other states have more flexible or vague terms for the notification timeframe, such as “as soon as practicable” (Maine), “in the most expedient time possible and without unreasonable delay” (New York), or “in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement” (California) 2 .  References:

Security Breach Notification Chart | Perkins Coie

State Data Breach Notification Chart - International Association of …

The federal act that does NOT contain provisions for preempting stricter state laws is the  Telemarketing Consumer Protection and Fraud Prevention Act 1 .  This act authorizes the Federal Trade Commission (FTC) to establish and enforce rules for telemarketing practices, such as the Do Not Call Registry, the prohibition of robocalls, and the disclosure of material information 2 .  However, the act also explicitly states that it does not " annul, alter, or affect, or exempt any person subject to the provisions of this section from complying with, the laws of any State with respect to telemarketing practices, except to the extent that those laws are inconsistent with any provision of this section, and then only to the extent of the inconsistency " 1 . This means that states can enact and enforce their own laws regarding telemarketing, as long as they are not less protective than the federal law.  In contrast, the other three acts listed in the question do contain preemption clauses that limit or override the authority of states to regulate certain aspects of electronic communications, online privacy, and credit transactions 3 4 5 .  References:   1 :  Telemarketing Consumer Protection and Fraud Prevention Act 2 :  Telemarketing Sales Rule | Federal Trade Commission 3 :  CAN-SPAM Act: A Compliance Guide for Business 4 :  Children’s Online Privacy Protection Rule (“COPPA”) | Federal Trade Commission 5 :  Fair and Accurate Credit Transactions Act of 2003 - Wikipedia  : IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 5: Federal Trade Commission and Consumer Privacy, p. 144-145, 149-150, 154-155